The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade prometheus | Aug 22, 2024 | May 19, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 19, 2021 |
| Freebsd | — | Upgrade prometheus2 | Nov 4, 2022 | Jun 1, 2021 |
| Suse | — | Upgrade python3-rhnlibUpgrade python3-mgr-osa-commonUpgrade python2-mgr-virtualization-hostUpgrade python2-spacewalk-oscapUpgrade dracut-saltbootUpgrade python2-mgr-virtualization-commonUpgrade spacecmdUpgrade python2-rhnlibUpgrade python3-mgr-cfgUpgrade python3-mgr-cfg-clientUpgrade python2-uyuni-common-libsUpgrade python3-mgr-osadUpgrade python2-spacewalk-koanUpgrade mgr-osadUpgrade python2-spacewalk-client-setupUpgrade spacewalk-checkUpgrade suseregisterinfoUpgrade python3-mgr-virtualization-hostUpgrade mgr-cfgUpgrade mgr-custom-infoUpgrade mgr-cfg-actionsUpgrade python2-mgr-cfg-managementUpgrade ansible-docUpgrade python2-mgr-cfgUpgrade python3-mgr-osa-dispatcherUpgrade python3-spacewalk-client-setupUpgrade python2-mgr-osa-commonUpgrade python3-spacewalk-oscapUpgrade mgr-virtualization-hostUpgrade python3-uyuni-common-libsUpgrade ansible-testUpgrade python2-mgr-osadUpgrade python2-mgr-pushUpgrade golang-github-prometheus-prometheusUpgrade python3-suseregisterinfoUpgrade python3-mgr-cfg-managementUpgrade spacewalk-client-toolsUpgrade mgr-cfg-managementUpgrade spacewalk-client-setupUpgrade spacewalk-koanUpgrade python2-spacewalk-checkUpgrade python2-mgr-cfg-actionsUpgrade spacewalk-oscapUpgrade python3-mgr-pushUpgrade mgr-cfg-clientUpgrade python3-mgr-virtualization-commonUpgrade python3-mgr-cfg-actionsUpgrade python2-mgr-cfg-clientUpgrade python3-spacewalk-koanUpgrade python2-mgr-osa-dispatcherUpgrade python2-spacewalk-client-toolsUpgrade python3-spacewalk-checkUpgrade mgr-pushUpgrade ansibleUpgrade python2-suseregisterinfoUpgrade python3-spacewalk-client-toolsUpgrade mgr-osa-dispatcher | Aug 13, 2021 | May 19, 2021 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | May 19, 2021 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub